Sign-in, MFA and SSO

Cerberon supports local accounts with multi-factor authentication, and single sign-on through OpenID Connect (OIDC) or SAML 2.0. Local accounts keep working when SSO is configured.

Sessions are held on the server and can be revoked. Passwords need at least 10 characters. Administrators set the session timeout and sign-in policy under Settings > Access.

Multi-factor authentication

Any TOTP authenticator app works, for example Microsoft Authenticator, Google Authenticator, Okta Verify or 1Password.

1. Open Profile and select Set up authenticator.
2. Scan the QR code and enter the code from the app.
3. Save the recovery codes shown, then select I have saved them.

Use a recovery code if you lose your authenticator. Issue new recovery codes replaces the set. If a user loses both, an operator on the host can remove the second factor:

cerberon reset-password <username> --clear-second-factor

Single sign-on

Configure identity providers under Settings > Access > Single Sign-On. You can add several, each with its own button on the sign-in page.

Your identity provider must reach Cerberon over HTTPS with a trusted certificate. Install your certificate or configure a reverse proxy first. See TLS and reverse proxy.

OpenID Connect

Works with Microsoft Entra ID, Okta, Google Workspace, Keycloak and any standard OIDC provider. Cerberon uses the authorisation code flow with PKCE.

1. In your identity provider, register Cerberon as a web application. Use the Redirect address shown on the Cerberon setup form, which is https://<your-cerberon-host>/api/sso/oidc/callback.
2. In Cerberon, enter the Issuer address, Client ID and Client secret, and optionally the Scopes (default openid email profile) and a Button label.

Providers without OIDC discovery can be added as OAuth, with the Authorization URL, Token URL and Userinfo URL.

SAML 2.0

1. In your identity provider, create a SAML application using the Entity ID and Reply URL shown on the Cerberon setup form. The reply URL is https://<your-cerberon-host>/api/sso/saml/acs, and metadata is published at https://<your-cerberon-host>/api/sso/saml/metadata.
2. In Cerberon, enter the identity provider’s Sign-in URL and Provider signing certificate.

Who can sign in and with which role

Setting	Effect
Who can sign in first	Email addresses or @domain entries, one per line, that get an account on first sign-in. Leave it blank to have an administrator create each account.
Default role	The role a new account receives.
Sign-in rules	Map identity provider claims to roles, one rule per line, for example groups = admins -> admin.
Trust sign-ins where the provider does not say the email is verified	Accept accounts whose email the provider has not verified. Leave it off unless your provider never sends that flag.

Recover an account

An operator with shell access to the host can recover any account. Cerberon has no emailed password reset.

Task	Command
List accounts	cerberon users
Set a new password	cerberon reset-password <username>
Remove the second factor	cerberon reset-password <username> --clear-second-factor
Re-enable a disabled account	cerberon reset-password <username> --enable